diff options
| author | Oleg Nesterov <oleg@redhat.com> | 2017-01-30 19:17:35 +0100 |
|---|---|---|
| committer | Eric W. Biederman <ebiederm@xmission.com> | 2017-02-01 06:20:48 +0100 |
| commit | c6c70f4455d1eda91065e93cc4f7eddf4499b105 (patch) | |
| tree | bf2f38330bc30a13329ae275172deffe863b36a8 /kernel/exit.c | |
| parent | vfs: open() with O_CREAT should not create inodes with unknown ids (diff) | |
| download | linux-c6c70f4455d1eda91065e93cc4f7eddf4499b105.tar.xz linux-c6c70f4455d1eda91065e93cc4f7eddf4499b105.zip | |
exit: fix the setns() && PR_SET_CHILD_SUBREAPER interaction
find_new_reaper() checks same_thread_group(reaper, child_reaper) to
prevent the cross-namespace reparenting but this is not enough if the
exiting parent was injected by setns() + fork().
Suppose we have a process P in the root namespace and some namespace X.
P does setns() to enter the X namespace, and forks the child C.
C forks a grandchild G and exits.
The grandchild G should be re-parented to X->child_reaper, but in this
case the ->real_parent chain does not lead to ->child_reaper, so it will
be wrongly reparanted to P's sub-reaper or a global init.
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Diffstat (limited to 'kernel/exit.c')
| -rw-r--r-- | kernel/exit.c | 13 |
1 files changed, 8 insertions, 5 deletions
diff --git a/kernel/exit.c b/kernel/exit.c index 8f14b866f9f6..5cfbd595f918 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -578,15 +578,18 @@ static struct task_struct *find_new_reaper(struct task_struct *father, return thread; if (father->signal->has_child_subreaper) { + unsigned int ns_level = task_pid(father)->level; /* * Find the first ->is_child_subreaper ancestor in our pid_ns. - * We start from father to ensure we can not look into another - * namespace, this is safe because all its threads are dead. + * We can't check reaper != child_reaper to ensure we do not + * cross the namespaces, the exiting parent could be injected + * by setns() + fork(). + * We check pid->level, this is slightly more efficient than + * task_active_pid_ns(reaper) != task_active_pid_ns(father). */ - for (reaper = father; - !same_thread_group(reaper, child_reaper); + for (reaper = father->real_parent; + task_pid(reaper)->level == ns_level; reaper = reaper->real_parent) { - /* call_usermodehelper() descendants need this check */ if (reaper == &init_task) break; if (!reaper->signal->is_child_subreaper) |